SCM-Manager

mirror of https://github.com/scm-manager/scm-manager.git synced 2026-01-18 13:32:10 +01:00

Files

Sebastian Sdorra 8aaa67cd6a #970 inspect mercurial commands in order to detect write requests

The HgPermissionFilter will now inspect the used mercurial command, of all requests which are using a read method like GET, HEAD, OPTIONS or TRACE and tread every one as write request, expect:
- no command was specified with the request (this is required for the hgweb ui)
- the command in the query string was found in the list of read commands
- if query string contains the batch command, then all commands specified in X-HgArg headers must be in the list of read commands
This change is required, in order to fix CVE-2018-1000132 for SCM-Manager.

2018-03-29 20:26:56 +02:00

scm-git-plugin

[maven-release-plugin] prepare for next development iteration

2018-02-09 08:14:35 +01:00

scm-hg-plugin

#970 inspect mercurial commands in order to detect write requests

2018-03-29 20:26:56 +02:00

scm-svn-plugin

[maven-release-plugin] prepare for next development iteration

2018-02-09 08:14:35 +01:00

pom.xml

[maven-release-plugin] prepare for next development iteration

2018-02-09 08:14:35 +01:00

README.txt

rename folder plugins to scm-plugins to match artifactId

2011-07-01 18:25:47 +02:00

README.txt

Plugins moved see https://bitbucket.org/sdorra/scm-manager/wiki/scm-plugins for details.